Internal Financial Controls

Internal Financial Controls

Who All Are Responsible? 3 What is Internal Financial Control (IFC)? 5 What is Internal financial controls over financial reporting (ICFR)? Internal Controls Global Perspective 7 Expected response of stakeholders 8 6 Expressing an opinion on internal control how will you do it 10

The Companies Act 2013 Who All Are Responsible? Section 134 Director s Responsibility Statement In the case of a listed company, the Directors Responsibility states that directors, have laid down IFC to be followed by the company and that such controls are adequate and operating effectively. Section 143 Auditor Report The auditor s report should also state whether the company has adequate IFC system in place and the operating effectiveness of such controls Section 177 Audit Committee Audit committee may call for comments of auditors about internal control systems before their submission to the Board and may also discuss any related issues with the internal and statutory auditors and the management of the company Sch IV Independent Directors The independent directors should satisfy themselves on the integrity of financial information and ensure that financial controls and systems of risk management are robust and defensible. Page 3

The Companies Act 2013 Who All Are Responsible? (contd.) 1 Requirement (as per previous slide) Director s Responsibility Statement (134) IFC Public Listed Paid-up share capital>= INR 10 Cr Public un-listed Turnover >= INR 100 Cr Loans, Borrowing in aggregate >= INR 50 Cr Pvt Cos pd up share capital >= INR 20 Cr 2 Auditor Report (143) 3 Audit Committee (177) 4 Independent Directors (Schedule IV) ICFR ICFR ICFR 5 ICFR Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 BOD report Financial Statements only (ICFR only) Page 4

What is Internal Financial Control (IFC)? (Sec 134) Components Internal Financial controls overs financial reporting (ICFR) Operational + + Fraud prevention = IFC controls Example Definition Sales realization is correctly recorded in the Financials As per Section 134 of the Companies Act 2013, the term Internal Financial Controls means the policies and procedures adopted by the company for ensuring: orderly and efficient conduct of its business, including adherence to company s policies, safeguarding of its assets, prevention and detection of frauds and errors, accuracy and completeness of the accounting records, and timely preparation of reliable financial information. Page 5 Discount on sale is offered as per DOA and adherence to DOA is monitored Unauthorised change in price master (access controls)

What is Internal financial controls over financial reporting (ICFR)? (Sec 143 - as per ICAI Nov 2014 guidelines) Components Definition Maintenance of financial records (Detail/ Accuracy) Authorizations of transactions (in accordance with GAAP) Safeguarding of the assets of the company + + = ICFR A process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company's internal financial control over financial reporting includes those policies and procedures : 1. Pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; 2. Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorisations of management and directors of the company; and 3. Provide reasonable assurance regarding prevention or timely detection of unauthorised acquisition, use, or disposition of the company's assets that could have a material effect on the financial statements. Page 6

Internal Controls Global Perspective Scope India ICFR + Policies/Procedures + Fraud + Safeguarding Assets USA Internal Control over Financial Reporting (ICFR) UK All material controls, including financial, operational and compliance controls Framework Components of Internal Controls as per SA 315 COSO The UK Corporate Governance Code Guidance ICAI Guidance Issued in November 2014 AS-6 UK Combined Code/Turnbull guidance Control assessment Yes CEO/CFO, Board Yes Yes Auditor attestation Yes ICFR Yes ICFR Yes Rigour of implementation Past precedent low Now - expected to be high High High Page 7

Expected response of stakeholders Board of Directors Company Management Create & test the framework of internal controls u IFC (including operational & Compliance) Auditors Focus on internal controls, to the extent these relate to the financial reporting (ICFR) Auditors responsibility limited to evaluation of Financial reporting controls u u Audit Committee/ Independent Director Would like to see a robust framework that is aligned to acceptable standards Review & question the basis of your controls design and ongoing assessments u u Would rely on the assessment and view of the Audit Committee They may ask for additional information u Controls documentation Page 8

How will IFC help beyond compliance? u Helps in business process re-designing to plug revenue leakages & cost containment opportunities u Helps in rationalizing the number of controls across organization moving to smart and automated controls u Helps in standardizing policies and procedures for multi-location/ multi-business Companies u Fosters a control conscious work culture for people behind controls u Provides assurance to the CEO/ CFO as well as improves business performance u In some instances, also serves as a base for blue print of optimal procedures while thinking about ERP Aimed at strengthening the processes to further improve business, identify cost containment opportunities as well as drive growth Page 9

Expressing an opinion on internal control how will you do it Scoping Design assessment Design Gap remediation Operating effectiveness (OE) Overall assessment and reporting One time Detailed scope Validate & document design Corrective action Prepare test strategy & plan Reporting approach Ongoing Update for changes Seek confirmation on changes Test controls Report Page 10 Leverage Technology for effective enablement of controls

Scoping Design assessment Gap remediation Operating effectiveness Assessment and reporting Key worksteps/ considerations for Scoping: u Map/ Identify significant accounts, processes and key locations u Segregate scope between Business Process and IT u Discuss/ align the scope with External Auditors u Define materiality Key/ non-key Risks u Finalize scope exclusion and validate with auditors u Define scope of processes/ activities performed by third parties u Nominate IFC Champion across processes/ locations u Set up a Steering Committee to review progress/ remediation plans u Align Audit Committee and Board Key Highlights (ICAI note) Significantly larger than CARO IFC (Sec 134) Vs. ICFR (143) IFC includes Operational while ICFR is only reporting Does not apply to consolidated financial statements SOCR reporting from third parties u Finalize templates, documentation standards, reporting packs u Conduct Training/ workshops with process owners Page 11

Scoping Design assessment Gap remediation Operating effectiveness Assessment and reporting COSO 2013 framework Codification of 17 principles embedded in the original framework 1. Control Environment 1. Demonstrates commitment to integrity and ethical values 2. Board of directors demonstrates independence from management and exercises oversight responsibility 3. Management, with board oversight, establishes structure, authority and responsibility 4. The organization demonstrates commitment to competence 5. The organization establishes accountability COSO 2013 Framework 2. Risk Assessment 3. Control Activities 4. Information & Communication 5. Monitoring 6. Specifies relevant objectives with sufficient clarity to enable identification of risks 7. Identifies and assesses risk 8. Considers the potential for fraud in assessing risk 9. Identifies and assesses significant change that could impact system of internal control 10.Selects and develops control activities 11. Selects and develops general controls over technology 12.Deploys through policies and procedures 13.Obtains or generates relevant, quality information 14.Communicates internally 15.Communicates externally 16.Selects, develops and performs ongoing and separate evaluations 17.Evaluates and communicates deficiencies Page 12

Scoping Design assessment Gap remediation Operating effectiveness Assessment and reporting Key work-steps/ considerations for Design assessment: u Finalize Process Owners across each process/ location u Perform & document walkthroughs (recommended) u Document process maps with input, output, risk/ controls, IPE u Segregate controls into Entity/ Process/ IT u Identity controls into Manual, Automated, IT dependent, Preventive/ Detective u Segregate controls into Document Risk & Control matrix with control description, owner, frequency, control evidence etc u Document IT General Controls (GITCs) u Perform Segregation of Duties analysis u Identify design gaps based on walkthroughs, interviews, discussion etc u Benchmarking of IFC controls consolidate, remove redundancy, Key Highlights (ICAI note) Perform Walkthroughs Document Process Flows Entity/ Transaction level GITC Segregation of Duties IT System overview Diagram IPE documentation Controls Benchmarking Page 13

Scoping Design assessment Gap remediation Operating effectiveness Assessment and reporting Key work-steps/ considerations for Gap remediation: u Prioritize financial gaps into Material/ non-material u Prioritize operational/ reputational gaps (if any) into H/M/L impact u Co-develop remediation plan with owners & implementation timelines u Periodic monitoring of remediation plans u Enhance/ optimize IT Controls u Standardized/ centralize processes (wherever possible) u Enhance SOP/ MIS/ DOA etc Key Highlights (ICAI note) Material weakness Test of Design (TOD) Remediation plans u Interim testing to confirm remediated gaps Page 14

Scoping Design assessment Gap remediation Operating effectiveness Testing Assessment and reporting Key work-steps/ considerations for Operating Effectiveness: u Align sampling strategy with auditors u Prepare testing plan & templates u Timing of testing Mid year and roll forward testing u Finalize resources competency & independence/ objectivity u Document testing results u Prioritize testing gaps into Material/ non-material u Identify mitigation/ compensating controls for material gaps u Co-develop remediation plans for testing gaps including owners and implementation timelines Key Highlights (ICAI note) Sampling methodology JE CAATs Linkage with ELCs Timing of testing Extending sample size Analysis of error in the sample - Tolerable error etc Page 15

Scoping Design assessment Gap remediation Operating effectiveness Assessment and reporting Key work-steps/ considerations for Gap remediation: u Finalize material weakness and update Executive management u Report to Audit Committee (AC) and Board Key Highlights (ICAI note) Opinion on IFC Material weakness Page 16